Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
chrbar
New Contributor

Question about Deep Inpection and Certificate problem with WebEx

Hello,

We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.

 

We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.

We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features).

But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site".

 

Do  you know how to avoid this pop-up?

Regards, Chris

1 Solution
hmtay_FTNT

Hi Chris,

 

>>In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.   Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

 

Yes, if you are doing deep-inspection specifically for WebEx only, then exempting it in the SSL profile would defeat the purpose. Unfortunately, there is not much we could do here to make the native application accept any SSL Certificates but their own.

 

HoMing

View solution in original post

3 REPLIES 3
hmtay_FTNT
Staff
Staff

Hello Chris,

 

SSL deep-inspection unfortunately only works for WebEx when accessed from the browser - harder to do certificate pinning on browsers than on native applications. On the native applications, they employ certificate pinning and hence you got the error when deep-inspection is enabled. They do not accept any certificates but their own. To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile. 

 

HoMing

chrbar

hmtay wrote:

To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile.

 

Thanks HoMing for this good explaination.

 

In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.

 

Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

 

Regards,

Chris

 

hmtay_FTNT

Hi Chris,

 

>>In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.   Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

 

Yes, if you are doing deep-inspection specifically for WebEx only, then exempting it in the SSL profile would defeat the purpose. Unfortunately, there is not much we could do here to make the native application accept any SSL Certificates but their own.

 

HoMing

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors